pquerna

Federation is something that is rarely promoted in modern ecosystems. Before Twitter/Facebook, we had RSS/Atom, but these have all failed as companies pour massives investments into "winner take all" approaches to their products. In the short term, it is easy to see why: Why compromise on iteration of features and UX by allowing a competitor to interoperate? Why wait for a new field to be standardized in Atom?

We see it all the time in the consumer space, federation has died, but even look in the infrastructure space, something like Docker: Yes, Docker Hub, is "kinda" open, I mean, anyone can create an account, but it's not a federated scheme where everyone can host their own Images easily. But we use it anyways, because its a better user experience, and its subsidized by a company not directly making revenue on it yet, but wanting to control the user experience.

So we drop support for any federated user experience pretty quickly. And now we are all on Slack, on Facebook, on Twitter.... And it is mostly great. Or we wouldn't still be there.

But I still wish for a federated future, but I doubt it will happen.

https://github.com/openssh/openssh-portable/blob/master/PROT...

When I first learned about OpenSSH Certskeys, I was really excited; Spent awhile trying to make it useful, but you end up building all the CA infrastructure, and this time instead of distributing certificates to servers once a year, you want to distribute certificates to your _users_ every month or two -- so the pain is higher, there is less automation, and everyone on your team feels it....

Exploring OpenSSH certs is what led me to founding ScaleFT. There had to be a better way.

ScaleFT Access leverages these SSH Certificates, but we expire them every 5 minutes to provide other features that are hard with the limited capabilities of the format:

https://www.scaleft.com/products/access/

There are patches to make OpenSSH use X.509, but they are not widely adopted... and asking people to patch a sshd is a non-starter for many environments.

Another method would be to add a headers to the response:

    Server-Push: /relative/url

https://github.com/gstein/pocore/blob/master/src/memory.c https://github.com/gstein/pocore/blob/wiki/MemoryManagement....

It's design is heavily influenced by real world experiences -- as this post even changed its benchmarks to reflect that in an HTTP server, a request uses maybe 100 small chunks per request, you can make different optimization choices.

Many servers are multi-threaded, but many are not. Using the proposed technique in a Node.js process, or nginx, is going to severely limit the number of new connections per second.

I believe that "ephemeral" or "dynamic" credentials is a concept that is just starting to emerge.

This particular implementation, I don't see what threats it is really stopping.

One question we lead with at ScaleFT is, "How Old should an SSH Key be?". It leads many to admit they have had the same key, across multiple companies, across multiple devices. The threats against that kind of private key are massive, everything from an old corporate backup at a company you don't even work at anymore, to an APT capturing it 3 weeks ago.

Basically using an SSH key, doesn't prove much, except that at any point in time, you had the associated private key. This is a pretty broad attestation of identity -- so generating a key for every use -- and then building in additional attestations of identity (eg, two factor) for the use of that key, is something I think we will see more of in the future.

https://developer.apple.com/library/mac/documentation/Develo...

Which for some features it just a fancy UI on top of dtrace, but still a good way to get started with these kinds of things.

None of these are abandonware. All three are VC-backed companies. An AGPLv3 license is extremely restrictive for what amounts to a code dump.

------------

  Do I have to sign a contributor agreement to modify the code?

  Will you take patches?

------------

So, I mean, er, thanks for open sourcing a dead project. But still under an AGPLv3 license.... meh.

I've seen similar attacks before, granted for lower amounts, but in many companies, finance departments sending out wires for many hundreds of thousands of dollars is a common operation -- suppliers, contracts signed, and everyone wants their wire transfer to be done ASAP.

Get an email from the CFO/CEO/SVP of X saying to wire money for contract Z ASAP, and action will be taken.

Atlassian probably fits the bill more and has proven revenue on it, while Slack is more... "SaaS" in my mind, and really hasn't proven long term revenue traction yet, though it is certainly looking good for them.

> A perception of winner-take-all markets

> Enterprise-oriented companies raise much less private capital;

> The average enterprise-oriented company (where the primary customer is a business) is worth $2.5 billion, less than half the average consumer company.

The enterprise space doesn't seem to be following the winner-take-all mentality as compared to consumer startups. At some point you are still hiring regionalized enterprise sales reps, and each of them can only have so much quota.

Is there a enterprise-unicorn where they don't have traditional-enterprise-sales? Where their distribution/acquisition closely follows consumer companies?

Per-node a difficult proposition -- the price of "per server" of something varies wildly, for example a t1.micro is roughly $9.50 a month, while a m4.4xlarge is $738. $40 on 9.50 seems extreme, but $40 on $738, and Atlas is only a 5% of the cost of your server.

But when your target customer is using high end instances, because they are creating more value for their company that way, a 5% upcharge for better management, can be justified. Mostly its because the team of ops/software engineers supporting production environment are going to cost more than the infrastructure anyways.

Additionally, any large deal (>1000 nodes) is gonna get negotiated anyways, so public pricing is kinda a wash.

Looks like currently you must set a file descriptor (though the docs mention the possibility of using a pipe). Once an FD is set, you do control pulling/pushing data to s2n.

Can you elaborate more on "not too well-performing"?

http://en.wikipedia.org/wiki/Apache_Harmony

The specific implementation of the OpenJDK is available under the GPL, but the TCK, which is basically all of the test cases, is essentially proprietary.

Can you imagine Google writing Go, but keeping the Test cases for themselves? Well, they would let you use the test cases, but only if you used Go in way Google wanted you to. If you wanted to compile Go on the Raspberry Pi, or on anything 'like' a Phone, well that was off limits, and you could no longer use the test cases.

It's bizarre. It's evil.

The JVM is a great platform, but it is not "free".

softlayer, dual Xeon 2000 Series: 512GB, $1,823.00/mo (3.56 $/gb/mo)

these are on-demand prices. pre-pay, or use a term discount, and its cheaper.

Build it yourself: You can build a Dell or similar on a 2-Xeon-proc (E5 series), your main limit is getting good prices on 16x 32GB DIMMS. But lets say you can buy the RAM for ~$6500, then its just dependent on the rest of your kit, lets say $10,000 flat for the whole server. $277.77/mo over 36 months, but you still need network infrastructure, and you might want a new one in 12 months, but you get the general idea.

[1] - http://www.rackspace.com/en-us/cloud/servers/onmetal

The challenges are with attribution though, in many electronic-only attacks, it "could be" anyone.

Companies like CrowdStrike have done some work to attribute PLA & China in some attacks:

http://blog.crowdstrike.com/hat-tribution-pla-unit-61486/ http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intellige...

But largely APT attacks are happening without repercussion, probably by many countries, including the US, and as a "defender" against many of these, it is terrible. The worst part is, I don't see it changing: Nothing right now is driving State-Actors to stop doing whatever they want against corporations.

We are essentially acting as an easy-to-use, "client focused", Certificate Authority for SSH and X.509.

So, in the simplest threat model, yes, if our hosted SaaS version is compromised, your infrastructure is threatened. We believe many of our larger customers will adopt an "on premise" style deployment for this and other reasons -- doing this on premise is not very different than their threat model for a central LDAP server or other identity provider many have today.

Having said that, we are incorporating all the best practices you would see in a CA for other purposes, and believe for some segments this is a viable and major improvement over their current security practices.

[1] - http://venturebeat.com/2015/05/11/scaleft-launches-with-800k...

"While the Tarsnap code itself has not been released under an open source license, some of the "reusable components" have been published separately under a BSD license"

http://www.tarsnap.com/oss.html

The source code for tarsnap is available to view, so you could audit/inspect it yourself, but it is not under an open source license.

Add some metadata for a machine that tarsnap should expect a once a day/week/month backup from this machine, and if it doesn't get one, to send you an email?

I do think its too bad that setuid binaries don't have additional restrictions, like 100% must be code-signed or must be run in a sandbox-exec[1] based on that signing.

[1] - https://developer.apple.com/library/mac/documentation/Darwin...

OpenStack Ironic[1] can do this today, given you had right hardware. Making that hardware "mutli-tenant" is not a trivial project, mostly because the firmware stacks are still very closed, but it can be done. Top of Rack switches are also another area of complexity/pain, but also feasible to overcome with a little engineering.

[1]: OpenStack has its complexities, but the OnMetal project has upstreamed everything feasible we can.